You are viewing documentation for Kubernetes version: v1.31
Kubernetes v1.31 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date information, see the latest version.
ClusterTrustBundle v1alpha1
apiVersion: certificates.k8s.io/v1alpha1
import "k8s.io/api/certificates/v1alpha1"
ClusterTrustBundle
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
ClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the clusterTrustBundle
projection. All service accounts have read access to ClusterTrustBundles by default. Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.
It can be optionally associated with a particular assigner, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.
-
apiVersion: certificates.k8s.io/v1alpha1
-
kind: ClusterTrustBundle
-
metadata (ObjectMeta)
metadata contains the object metadata.
-
spec (ClusterTrustBundleSpec), required
spec contains the signer (if any) and trust anchors.
ClusterTrustBundleSpec
ClusterTrustBundleSpec contains the signer and trust anchors.
-
trustBundle (string), required
trustBundle contains the individual X.509 trust anchors for this bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
The data must consist only of PEM certificate blocks that parse as valid X.509 certificates. Each certificate must include a basic constraints extension with the CA bit set. The API server will reject objects that contain duplicate certificates, or that use PEM block headers.
Users of ClusterTrustBundles, including Kubelet, are free to reorder and deduplicate certificate blocks in this file according to their own logic, as well as to drop PEM block headers and inter-block data.
-
signerName (string)
signerName indicates the associated signer, if any.
In order to create or update a ClusterTrustBundle that sets signerName, you must have the following cluster-scoped permission: group=certificates.k8s.io resource=signers resourceName=<the signer name> verb=attest.
If signerName is not empty, then the ClusterTrustBundle object must be named with the signer name as a prefix (translating slashes to colons). For example, for the signer name
example.com/foo
, valid ClusterTrustBundle object names includeexample.com:foo:abc
andexample.com:foo:v1
.If signerName is empty, then the ClusterTrustBundle object's name must not have such a prefix.
List/watch requests for ClusterTrustBundles can filter on this field using a
spec.signerName=NAME
field selector.
ClusterTrustBundleList
ClusterTrustBundleList is a collection of ClusterTrustBundle objects
-
apiVersion: certificates.k8s.io/v1alpha1
-
kind: ClusterTrustBundleList
-
metadata (ListMeta)
metadata contains the list metadata.
-
items ([]ClusterTrustBundle), required
items is a collection of ClusterTrustBundle objects
Operations
get
read the specified ClusterTrustBundle
HTTP Request
GET /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
Parameters
-
name (in path): string, required
name of the ClusterTrustBundle
-
pretty (in query): string
Response
200 (ClusterTrustBundle): OK
401: Unauthorized
list
list or watch objects of kind ClusterTrustBundle
HTTP Request
GET /apis/certificates.k8s.io/v1alpha1/clustertrustbundles
Parameters
-
allowWatchBookmarks (in query): boolean
-
continue (in query): string
-
fieldSelector (in query): string
-
labelSelector (in query): string
-
limit (in query): integer
-
pretty (in query): string
-
resourceVersion (in query): string
-
resourceVersionMatch (in query): string
-
sendInitialEvents (in query): boolean
-
timeoutSeconds (in query): integer
-
watch (in query): boolean
Response
200 (ClusterTrustBundleList): OK
401: Unauthorized
create
create a ClusterTrustBundle
HTTP Request
POST /apis/certificates.k8s.io/v1alpha1/clustertrustbundles
Parameters
-
body: ClusterTrustBundle, required
-
dryRun (in query): string
-
fieldManager (in query): string
-
fieldValidation (in query): string
-
pretty (in query): string
Response
200 (ClusterTrustBundle): OK
201 (ClusterTrustBundle): Created
202 (ClusterTrustBundle): Accepted
401: Unauthorized
update
replace the specified ClusterTrustBundle
HTTP Request
PUT /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
Parameters
-
name (in path): string, required
name of the ClusterTrustBundle
-
body: ClusterTrustBundle, required
-
dryRun (in query): string
-
fieldManager (in query): string
-
fieldValidation (in query): string
-
pretty (in query): string
Response
200 (ClusterTrustBundle): OK
201 (ClusterTrustBundle): Created
401: Unauthorized
patch
partially update the specified ClusterTrustBundle
HTTP Request
PATCH /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
Parameters
-
name (in path): string, required
name of the ClusterTrustBundle
-
body: Patch, required
-
dryRun (in query): string
-
fieldManager (in query): string
-
fieldValidation (in query): string
-
force (in query): boolean
-
pretty (in query): string
Response
200 (ClusterTrustBundle): OK
201 (ClusterTrustBundle): Created
401: Unauthorized
delete
delete a ClusterTrustBundle
HTTP Request
DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
Parameters
-
name (in path): string, required
name of the ClusterTrustBundle
-
body: DeleteOptions
-
dryRun (in query): string
-
gracePeriodSeconds (in query): integer
-
pretty (in query): string
-
propagationPolicy (in query): string
Response
200 (Status): OK
202 (Status): Accepted
401: Unauthorized
deletecollection
delete collection of ClusterTrustBundle
HTTP Request
DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles
Parameters
-
body: DeleteOptions
-
continue (in query): string
-
dryRun (in query): string
-
fieldSelector (in query): string
-
gracePeriodSeconds (in query): integer
-
labelSelector (in query): string
-
limit (in query): integer
-
pretty (in query): string
-
propagationPolicy (in query): string
-
resourceVersion (in query): string
-
resourceVersionMatch (in query): string
-
sendInitialEvents (in query): boolean
-
timeoutSeconds (in query): integer
Response
200 (Status): OK
401: Unauthorized
This page is automatically generated.
If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.